U.S. Senator Ron Wyden has called on the Federal Trade Commission (FTC) to investigate Microsoft for what he described as “gross cybersecurity negligence” that he says poses an ongoing threat to U.S. national security.
In a September 10 letter to FTC Chairman Andrew Ferguson, Wyden accused Microsoft of creating vulnerabilities that have led to ransomware attacks on critical infrastructure, including health care organizations. He argued that Microsoft’s default Windows configurations and continued support for outdated encryption standards have left customers exposed.
Wyden compared the company to “an arsonist selling firefighting services,” saying its dominance in enterprise IT leaves agencies and firms with “no choice” but to use its products despite the risks.
The Ascension Case
Wyden highlighted the May 2024 ransomware attack on Ascension, a major U.S. hospital operator, as a prime example. Hackers reportedly exploited a contractor’s laptop after a malicious link appeared through Microsoft’s Bing search engine, eventually breaching Ascension’s Active Directory server and exposing the data of 5.6 million people.
Wyden said Microsoft’s default encryption settings — particularly support for the outdated RC4 standard — facilitated the attack.
Microsoft’s Response
Microsoft acknowledged that RC4 is insecure but stressed it makes up “less than 0.1% of traffic.” The company said it discourages use of RC4 but cannot yet fully disable it because “disabling its use completely would break many customer systems.”
The company pledged to disable RC4 by default in certain Windows products starting Q1 2026 and to roll out additional mitigations.
Broader Context
Wyden has repeatedly urged scrutiny of Microsoft’s role in cyber incidents, including the July 2023 breach by Chinese-linked hackers who stole thousands of U.S. officials’ emails.
The FTC confirmed receipt of Wyden’s letter but offered no further comment.
The senator’s push comes amid broader concerns that the monopoly-like grip of Microsoft on enterprise IT both amplifies security risks and limits customers’ ability to choose safer alternatives.